Security firm V12 reported on October 22 that AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it. The default client set no spending limit until releases on August 18 added one. The risk applied to agents that sign payments automatically in apps that set no limits of their own. It is one of 25 flaws V12 found by reviewing the code and running local tests, three of which it rated critical. According to The Hacker News, neither V12 nor the x402 Foundation has reported any attacks using them.
x402 is an open standard that lets software pay for an API call inside the web request: a server answers with HTTP 402 Payment Required and lists payment options, and the client signs one and retries. The default client took the first option and, before the fix, applied no limit to the amount. The other two critical flaws: the TypeScript facilitator for Solana, which checks payments, accepted a token approval (which moves no tokens) as a valid payment in V12’s local test, letting a merchant deliver a paid resource for nothing; and the Sign-In-With-X client signed login messages without checking that the website named in them was the one it was talking to, so a hostile server could relay a login from another site. The Hacker News reports the foundation published no security advisory and its changelogs do not call these security fixes, and that npm audit and PyPI showed no advisories for the affected releases as of October 23, so dependency scanners would not warn developers.
How to check if you’re affected
Affected products are applications and facilitators built on the x402 TypeScript, Python or Go SDKs that predate the August 18 releases. Per The Hacker News, TypeScript clients get the spending cap by updating @x402/fetch or @x402/axios to version 2.23.0 or later, apps that use Sign-In-With-X need @x402/extensions 2.23.0 or later, and Solana facilitators need @x402/svm 2.23.0 or later; every @x402/svm release from 2.0.0 to 2.22.0 lacks the instruction check. The Python and Go version numbers for the August 18 fixes are not stated in the article; check each package’s changelog.
- As of October 23 the latest releases were 2.28.0 for the TypeScript packages, v2.28.0 for the Go module and 2.25.0 for Python, which also include a later fix for a separate payment bypass in @x402/core 2.27.0.
- After upgrading, clients are capped at $1 per payment and limited to U.S. dollar stablecoins the SDK recognizes, such as USDC, so check that this fits your use.
- TypeScript code that calls createSIWxPayload directly must now pass the URL of the 402 response, after any redirects.